Subject: RE: Question about libpcap
To: David Maxwell <>
From: Gerald Lee <>
List: tech-net
Date: 07/20/2007 09:58:03
-----Original Message-----
David Maxwell Thursday, July 19, 2007 7:47 PM
>On Thu, Jul 19, 2007 at 07:14:44PM -0700, Gerald Lee wrote:
>>      We have a unique situation.  An engineer want to use libpcap to
>> create compile a packet filter.  However, he wants to use it purely
>> memory.  The problem comes in that the application is threaded, and
>> of the other threads is blocked on stdin.  This causes the parser to
>> attempt to get more input from stdin.  He tracked it down to the
>When you say 'the parser' - do you mean the bpf lex/yacc machine?
Yes, sorry to be less than complete.
>> of yyin, and would just as soon directly manipulate it.  Others of us
>> are discouraging this approach.
>>      However, I need to give him either 1) the appropriate
>> incantations, or 2) a new interface (or variation on the current
>> We've tried things like pcap_compile_nocap, and still see the
>I'm not following the description of the problem here.
>pcap_compile_nopcap takes the filter program as the str argument, and
>shouldn't be touching any file handles...
Once more, I'm working partially off of our engineers description of
his interaction with it.  It appears to be a an assumption that in
the non-interactive case, yyin will be null or something like that.
Our application is threaded, and another thread has stdin and is
blocked on it.  It appears that once the parser (lex/yacc machine)
processes the given input, it will wait on yyin if that variable is
His answer was to directly manipulate this, obviously generated,
variable directly.  I'm trying to get a quick answer to him so
this nonsense doesn't happen.
- bob